WordPress Plugin Vulnerabilities

Open Graph < 1.11.3 - Unauthenticated Sensitive Information Exposure

Description

The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'opengraph_default_description' function. This makes it possible for unauthenticated attackers to extract sensitive data including partial content of password-protected blog posts.

Affects Plugins

Plugin icon
opengraph
Fixed in 1.11.3

References

CVE
CVE-2024-5615
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f57dc0fe-07f3-457e-8080-fe530f6a9f01

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Krzysztof Zając
Verified
No
WPVDB ID
6e139f2e-f70e-4525-82bc-da1db92c1b89

Timeline

Publicly Published
2024-06-04 (about 2 years ago)
Added
2024-06-05 (about 2 years ago)
Last Updated
2024-06-06 (about 2 years ago)

Other

Published
Title
Published
2024-10-21
Title
Schema & Structured Data for WP & AMP < 1.36 - Unauthenticated Sensitive Information Exposure
Published
2025-02-24
Title
Classified Listing – Classified ads & Business Directory Plugin < 4.0.5 - Unauthenticated Settings Exposure
Published
2026-05-12
Title
Broadstreet < 1.53.2 - Authenticated (Subscriber+) Information Disclosure
Published
2026-05-08
Title
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity < 3.3.7 - Unauthenticated Information Disclosure via REST API
Published
2024-03-07
Title
Simple Restrict < 1.2.7 - Missing Authorization to Sensitive Information Exposure